ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade proftpd-dfsg | Jul 30, 2024 | Apr 4, 2017 |
| Freebsd | — | Upgrade proftpd | Jul 27, 2017 | Jul 27, 2017 |
| Oracle Solaris | — | Upgrade service/network/ftp to version 1.3.6-0.175.3.34.0.2.0 on Solaris 11.3 | Jul 18, 2018 | Apr 4, 2017 |
| Proftp Proftpd | — | Update ProFTP ProFTPd to the latest version | Nov 6, 2025 | Apr 4, 2017 |
| Suse | — | Upgrade proftpd-ldapUpgrade proftpd-develUpgrade proftpd-mysqlUpgrade proftpdUpgrade proftpd-langUpgrade proftpd-radiusUpgrade proftpd-docUpgrade proftpd-sqliteUpgrade proftpd-pgsql | Apr 19, 2017 | Apr 4, 2017 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 4, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub